;NTDLL.DLL
CsrAllocateCaptureBuffer% = 2
CsrAllocateMessagePointer% = 3
CsrCaptureMessageBuffer% = 4
CsrCaptureMessageMultiUnicodeStringsInPlace% = 3
CsrCaptureMessageString% = 5
CsrCaptureTimeout% = 2
CsrClientCallServer% = 4
CsrClientConnectToServer% = 5
CsrFreeCaptureBuffer% = 1
CsrGetProcessId% = 0
CsrIdentifyAlertableThread% = 0
CsrNewThread% = 0
CsrProbeForRead% = 3
CsrProbeForWrite% = 3
CsrSetPriorityClass% = 2
DbgBreakPoint% = 0
DbgPrompt% = 3
DbgQueryDebugFilterState% = 2
DbgSetDebugFilterState% = 3
DbgUiConnectToDbg% = 0
DbgUiContinue% = 2
DbgUiConvertStateChangeStructure% = 2
DbgUiDebugActiveProcess% = 1
DbgUiGetThreadDebugObject% = 0
DbgUiIssueRemoteBreakin% = 1
DbgUiRemoteBreakin% = 1
DbgUiSetThreadDebugObject% = 1
DbgUiStopDebugging% = 1
DbgUiWaitStateChange% = 2
DbgUserBreakPoint% = 0
EH_VirtualQuery% = 3
KiFastSystemCall% = 0
KiFastSystemCallRet% = 0
KiIntSystemCall% = 0
KiRaiseUserExceptionDispatcher% = 0
KiUserApcDispatcher% = 5
KiUserCallbackDispatcher% = 3
KiUserExceptionDispatcher% = 2
LdrAccessOutOfProcessResource% = 5
LdrAccessResource% = 4
LdrAddRefDll% = 2
LdrAlternateResourcesEnabled% = 0
LdrCreateOutOfProcessImage% = 4
LdrDestroyOutOfProcessImage% = 1
LdrDisableThreadCalloutsForDll% = 1
LdrEnumResources% = 5
LdrEnumerateLoadedModules% = 3
LdrFindCreateProcessManifest% = 5
LdrFindEntryForAddress% = 2
LdrFindResourceDirectory_U% = 4
LdrFindResourceEx_U% = 5
LdrFindResource_U% = 4
LdrFlushAlternateResourceModules% = 0
LdrGetDllHandle% = 4
LdrGetDllHandleEx% = 5
LdrGetProcedureAddress% = 4
LdrHotPatchRoutine% = 1
LdrInitShimEngineDynamic% = 1
LdrInitializeThunk% = 4
LdrLoadAlternateResourceModule% = 2
LdrLoadDll% = 4
LdrLockLoaderLock% = 3
LdrProcessRelocationBlock% = 4
LdrQueryImageFileExecutionOptions% = 6
LdrQueryProcessModuleInformation% = 3
LdrSetAppCompatDllRedirectionCallback% = 3
LdrSetDllManifestProber% = 1
LdrShutdownProcess% = 0
LdrShutdownThread% = 0
LdrUnloadAlternateResourceModule% = 1
LdrUnloadDll% = 1
LdrUnlockLoaderLock% = 2
LdrVerifyImageMatchesChecksum% = 4
NtAcceptConnectPort% = 6
NtAccessCheck% = 8
NtAccessCheckAndAuditAlarm% = 11
NtAccessCheckByType% = 11
NtAccessCheckByTypeAndAuditAlarm% = 16
NtAccessCheckByTypeResultList% = 11
NtAccessCheckByTypeResultListAndAuditAlarm% = 16
NtAccessCheckByTypeResultListAndAuditAlarmByHandle% = 17
NtAddAtom% = 3
NtAddBootEntry% = 2
NtAdjustGroupsToken% = 6
NtAdjustPrivilegesToken% = 6
NtAlertResumeThread% = 2
NtAlertThread% = 1
NtAllocateLocallyUniqueId% = 1
NtAllocateUserPhysicalPages% = 3
NtAllocateUuids% = 4
NtAllocateVirtualMemory% = 6
NtAreMappedFilesTheSame% = 2
NtAssignProcessToJobObject% = 2
NtCallbackReturn% = 3
NtCancelDeviceWakeupRequest% = 1
NtCancelIoFile% = 2
NtCancelTimer% = 2
NtClearEvent% = 1
NtClose% = 1
NtCloseObjectAuditAlarm% = 3
NtCompactKeys% = 2
NtCompareTokens% = 3
NtCompleteConnectPort% = 1
NtCompressKey% = 1
NtConnectPort% = 8
NtContinue% = 2
NtCreateDebugObject% = 4
NtCreateDirectoryObject% = 3
NtCreateEvent% = 5
NtCreateEventPair% = 3
NtCreateFile% = 11
NtCreateIoCompletion% = 4
NtCreateJobObject% = 3
NtCreateJobSet% = 3
NtCreateKey% = 7
NtCreateKeyedEvent% = 4
NtCreateMailslotFile% = 8
NtCreateMutant% = 4
NtCreateNamedPipeFile% = 14
NtCreatePagingFile% = 4
NtCreatePort% = 5
NtCreateProcess% = 8
NtCreateProcessEx% = 9
NtCreateProfile% = 9
NtCreateSection% = 7
NtCreateSemaphore% = 5
NtCreateSymbolicLinkObject% = 4
NtCreateThread% = 8
NtCreateTimer% = 4
NtCreateToken% = 13
NtCreateWaitablePort% = 5
NtCurrentTeb% = 0
NtDebugActiveProcess% = 2
NtDebugContinue% = 3
NtDelayExecution% = 2
NtDeleteAtom% = 1
NtDeleteBootEntry% = 1
NtDeleteFile% = 1
NtDeleteKey% = 1
NtDeleteObjectAuditAlarm% = 3
NtDeleteValueKey% = 2
NtDeviceIoControlFile% = 10
NtDisplayString% = 1
NtDuplicateObject% = 7
NtDuplicateToken% = 6
NtEnumerateBootEntries% = 2
NtEnumerateKey% = 6
NtEnumerateSystemEnvironmentValuesEx% = 3
NtEnumerateValueKey% = 6
NtExtendSection% = 2
NtFilterToken% = 6
NtFindAtom% = 3
NtFlushBuffersFile% = 2
NtFlushInstructionCache% = 3
NtFlushKey% = 1
NtFlushVirtualMemory% = 4
NtFlushWriteBuffer% = 0
NtFreeUserPhysicalPages% = 3
NtFreeVirtualMemory% = 4
NtFsControlFile% = 10
NtGetContextThread% = 2
NtGetDevicePowerState% = 2
NtGetPlugPlayEvent% = 4
NtGetWriteWatch% = 7
NtImpersonateAnonymousToken% = 1
NtImpersonateClientOfPort% = 2
NtImpersonateThread% = 3
NtInitializeRegistry% = 1
NtInitiatePowerAction% = 4
NtIsProcessInJob% = 2
NtIsSystemResumeAutomatic% = 0
NtListenPort% = 2
NtLoadDriver% = 1
NtLoadKey2% = 3
NtLoadKey% = 2
NtLockFile% = 10
NtLockProductActivationKeys% = 2
NtLockRegistryKey% = 1
NtLockVirtualMemory% = 4
NtMakePermanentObject% = 1
NtMakeTemporaryObject% = 1
NtMapUserPhysicalPages% = 3
NtMapUserPhysicalPagesScatter% = 3
NtMapViewOfSection% = 10
NtModifyBootEntry% = 1
NtNotifyChangeDirectoryFile% = 9
NtNotifyChangeKey% = 10
NtNotifyChangeMultipleKeys% = 12
NtOpenDirectoryObject% = 3
NtOpenEvent% = 3
NtOpenEventPair% = 3
NtOpenFile% = 6
NtOpenIoCompletion% = 3
NtOpenJobObject% = 3
NtOpenKey% = 3
NtOpenKeyedEvent% = 3
NtOpenMutant% = 3
NtOpenObjectAuditAlarm% = 12
NtOpenProcess% = 4
NtOpenProcessToken% = 3
NtOpenProcessTokenEx% = 4
NtOpenSection% = 3
NtOpenSemaphore% = 3
NtOpenSymbolicLinkObject% = 3
NtOpenThread% = 4
NtOpenThreadToken% = 4
NtOpenThreadTokenEx% = 5
NtOpenTimer% = 3
NtPlugPlayControl% = 3
NtPowerInformation% = 5
NtPrivilegeCheck% = 3
NtPrivilegeObjectAuditAlarm% = 6
NtPrivilegedServiceAuditAlarm% = 5
NtProtectVirtualMemory% = 5
NtPulseEvent% = 2
NtQueryAttributesFile% = 2
NtQueryBootEntryOrder% = 2
NtQueryBootOptions% = 2
NtQueryDebugFilterState% = 2
NtQueryDefaultLocale% = 2
NtQueryDefaultUILanguage% = 1
NtQueryDirectoryFile% = 11
NtQueryDirectoryObject% = 7
NtQueryEaFile% = 9
NtQueryEvent% = 5
NtQueryFullAttributesFile% = 2
NtQueryInformationAtom% = 5
NtQueryInformationFile% = 5
NtQueryInformationJobObject% = 5
NtQueryInformationPort% = 5
NtQueryInformationProcess% = 5
NtQueryInformationThread% = 5
NtQueryInformationToken% = 5
NtQueryInstallUILanguage% = 1
NtQueryIntervalProfile% = 2
NtQueryIoCompletion% = 5
NtQueryKey% = 5
NtQueryMultipleValueKey% = 6
NtQueryMutant% = 5
NtQueryObject% = 5
NtQueryOpenSubKeys% = 2
NtQueryPerformanceCounter% = 2
NtQueryPortInformationProcess% = 0
NtQueryQuotaInformationFile% = 9
NtQuerySection% = 5
NtQuerySecurityObject% = 5
NtQuerySemaphore% = 5
NtQuerySymbolicLinkObject% = 3
NtQuerySystemEnvironmentValue% = 4
NtQuerySystemEnvironmentValueEx% = 5
NtQuerySystemInformation% = 4
NtQuerySystemTime% = 1
NtQueryTimer% = 5
NtQueryTimerResolution% = 3
NtQueryValueKey% = 6
NtQueryVirtualMemory% = 6
NtQueryVolumeInformationFile% = 5
NtQueueApcThread% = 5
NtRaiseException% = 3
NtRaiseHardError% = 6
NtReadFile% = 9
NtReadFileScatter% = 9
NtReadRequestData% = 6
NtReadVirtualMemory% = 5
NtRegisterThreadTerminatePort% = 1
NtReleaseKeyedEvent% = 4
NtReleaseMutant% = 2
NtReleaseSemaphore% = 3
NtRemoveIoCompletion% = 5
NtRemoveProcessDebug% = 2
NtRenameKey% = 2
NtReplaceKey% = 3
NtReplyPort% = 2
NtReplyWaitReceivePort% = 4
NtReplyWaitReceivePortEx% = 5
NtReplyWaitReplyPort% = 2
NtRequestDeviceWakeup% = 1
NtRequestPort% = 2
NtRequestWaitReplyPort% = 3
NtRequestWakeupLatency% = 1
NtResetEvent% = 2
NtResetWriteWatch% = 3
NtRestoreKey% = 3
NtResumeProcess% = 1
NtResumeThread% = 2
NtSaveKey% = 2
NtSaveKeyEx% = 3
NtSaveMergedKeys% = 3
NtSecureConnectPort% = 9
NtSetBootEntryOrder% = 2
NtSetBootOptions% = 2
NtSetContextThread% = 2
NtSetDebugFilterState% = 3
NtSetDefaultHardErrorPort% = 1
NtSetDefaultLocale% = 2
NtSetDefaultUILanguage% = 1
NtSetEaFile% = 4
NtSetEvent% = 2
NtSetEventBoostPriority% = 1
NtSetHighEventPair% = 1
NtSetHighWaitLowEventPair% = 1
NtSetInformationDebugObject% = 5
NtSetInformationFile% = 5
NtSetInformationJobObject% = 4
NtSetInformationKey% = 4
NtSetInformationObject% = 4
NtSetInformationProcess% = 4
NtSetInformationThread% = 4
NtSetInformationToken% = 4
NtSetIntervalProfile% = 2
NtSetIoCompletion% = 5
NtSetLdtEntries% = 6
NtSetLowEventPair% = 1
NtSetLowWaitHighEventPair% = 1
NtSetQuotaInformationFile% = 4
NtSetSecurityObject% = 3
NtSetSystemEnvironmentValue% = 2
NtSetSystemEnvironmentValueEx% = 5
NtSetSystemInformation% = 3
NtSetSystemPowerState% = 3
NtSetSystemTime% = 2
NtSetThreadExecutionState% = 2
NtSetTimer% = 7
NtSetTimerResolution% = 3
NtSetUuidSeed% = 1
NtSetValueKey% = 6
NtSetVolumeInformationFile% = 5
NtShutdownSystem% = 1
NtSignalAndWaitForSingleObject% = 4
NtStartProfile% = 1
NtStopProfile% = 1
NtSuspendProcess% = 1
NtSuspendThread% = 2
NtSystemDebugControl% = 6
NtTerminateJobObject% = 2
NtTerminateProcess% = 2
NtTerminateThread% = 2
NtTestAlert% = 0
NtTraceEvent% = 4
NtTranslateFilePath% = 4
NtUnloadDriver% = 1
NtUnloadKey% = 1
NtUnloadKeyEx% = 2
NtUnlockFile% = 5
NtUnlockVirtualMemory% = 4
NtUnmapViewOfSection% = 2
NtVdmControl% = 2
NtWaitForDebugEvent% = 4
NtWaitForKeyedEvent% = 4
NtWaitForMultipleObjects% = 5
NtWaitForSingleObject% = 3
NtWaitHighEventPair% = 1
NtWaitLowEventPair% = 1
NtWriteFile% = 9
NtWriteFileGather% = 9
NtWriteRequestData% = 6
NtWriteVirtualMemory% = 5
NtYieldExecution% = 0
PfxFindPrefix% = 2
PfxInitialize% = 1
PfxInsertPrefix% = 3
PfxRemovePrefix% = 2
RtlAbortRXact% = 1
RtlAbsoluteToSelfRelativeSD% = 3
RtlAcquirePebLock% = 0
RtlAcquireResourceExclusive% = 2
RtlAcquireResourceShared% = 2
RtlActivateActivationContext% = 3
RtlActivateActivationContextEx% = 4
RtlActivateActivationContextUnsafeFast% = 2
RtlAddAccessAllowedAce% = 4
RtlAddAccessAllowedAceEx% = 5
RtlAddAccessAllowedObjectAce% = 7
RtlAddAccessDeniedAce% = 4
RtlAddAccessDeniedAceEx% = 5
RtlAddAccessDeniedObjectAce% = 7
RtlAddAce% = 5
RtlAddActionToRXact% = 6
RtlAddAtomToAtomTable% = 3
RtlAddAttributeActionToRXact% = 8
RtlAddAuditAccessAce% = 6
RtlAddAuditAccessAceEx% = 7
RtlAddAuditAccessObjectAce% = 9
RtlAddCompoundAce% = 6
RtlAddRange% = 9
RtlAddRefActivationContext% = 1
RtlAddRefMemoryStream% = 1
RtlAddVectoredExceptionHandler% = 2
RtlAddressInSectionTable% = 3
RtlAdjustPrivilege% = 4
RtlAllocateAndInitializeSid% = 11
RtlAllocateHandle% = 2
RtlAllocateHeap% = 3
RtlAnsiCharToUnicodeChar% = 1
RtlAnsiStringToUnicodeSize% = 1
RtlAnsiStringToUnicodeString% = 3
RtlAppendAsciizToString% = 2
RtlAppendPathElement% = 3
RtlAppendStringToString% = 2
RtlAppendUnicodeStringToString% = 2
RtlAppendUnicodeToString% = 2
RtlApplicationVerifierStop% = 10
RtlApplyRXact% = 1
RtlApplyRXactNoFlush% = 1
RtlAreAllAccessesGranted% = 2
RtlAreAnyAccessesGranted% = 2
RtlAreBitsClear% = 3
RtlAreBitsSet% = 3
RtlAssert2% = 5
RtlAssert% = 4
RtlCancelTimer% = 2
RtlCaptureContext% = 1
RtlCaptureStackBackTrace% = 4
RtlCaptureStackContext% = 3
RtlCharToInteger% = 3
RtlCheckForOrphanedCriticalSections% = 1
RtlCheckProcessParameters% = 4
RtlCheckRegistryKey% = 2
RtlClearAllBits% = 1
RtlClearBits% = 3
RtlCloneMemoryStream% = 2
RtlCommitMemoryStream% = 2
RtlCompactHeap% = 2
RtlCompareMemory% = 3
RtlCompareMemoryUlong% = 3
RtlCompareString% = 3
RtlCompareUnicodeString% = 3
RtlCompressBuffer% = 8
RtlComputeCrc32% = 3
RtlComputeImportTableHash% = 3
RtlComputePrivatizedDllName_U% = 3
RtlConsoleMultiByteToUnicodeN% = 6
RtlConvertExclusiveToShared% = 1
RtlConvertLongToLargeInteger% = 1
RtlConvertSharedToExclusive% = 1
RtlConvertSidToUnicodeString% = 3
RtlConvertToAutoInheritSecurityObject% = 6
RtlConvertUiListToApiList% = 3
RtlConvertUlongToLargeInteger% = 1
RtlCopyLuid% = 2
RtlCopyLuidAndAttributesArray% = 3
RtlCopyMemoryStreamTo% = 6
RtlCopyOutOfProcessMemoryStreamTo% = 6
RtlCopyRangeList% = 2
RtlCopySecurityDescriptor% = 2
RtlCopySid% = 3
RtlCopySidAndAttributesArray% = 7
RtlCopyString% = 2
RtlCopyUnicodeString% = 2
RtlCreateAcl% = 3
RtlCreateActivationContext% = 6
RtlCreateAndSetSD% = 5
RtlCreateAtomTable% = 2
RtlCreateBootStatusDataFile% = 0
RtlCreateEnvironment% = 2
RtlCreateHeap% = 6
RtlCreateProcessParameters% = 10
RtlCreateQueryDebugBuffer% = 2
RtlCreateRegistryKey% = 2
RtlCreateSecurityDescriptor% = 2
RtlCreateSystemVolumeInformationFolder% = 1
RtlCreateTagHeap% = 4
RtlCreateTimer% = 7
RtlCreateTimerQueue% = 1
RtlCreateUnicodeString% = 2
RtlCreateUnicodeStringFromAsciiz% = 2
RtlCreateUserProcess% = 10
RtlCreateUserSecurityObject% = 7
RtlCreateUserThread% = 10
RtlCustomCPToUnicodeN% = 6
RtlCutoverTimeToSystemTime% = 4
RtlDeNormalizeProcessParams% = 1
RtlDeactivateActivationContext% = 2
RtlDeactivateActivationContextUnsafeFast% = 1
RtlDebugPrintTimes% = 0
RtlDecodePointer% = 1
RtlDecodeSystemPointer% = 1
RtlDecompressBuffer% = 6
RtlDecompressFragment% = 8
RtlDefaultNpAcl% = 1
RtlDelete% = 1
RtlDeleteAce% = 2
RtlDeleteAtomFromAtomTable% = 2
RtlDeleteCriticalSection% = 1
RtlDeleteElementGenericTable% = 2
RtlDeleteElementGenericTableAvl% = 2
RtlDeleteNoSplay% = 2
RtlDeleteOwnersRanges% = 2
RtlDeleteRange% = 6
RtlDeleteRegistryValue% = 3
RtlDeleteResource% = 1
RtlDeleteSecurityObject% = 1
RtlDeleteTimer% = 3
RtlDeleteTimerQueue% = 1
RtlDeleteTimerQueueEx% = 2
RtlDeregisterWait% = 1
RtlDeregisterWaitEx% = 2
RtlDestroyAtomTable% = 1
RtlDestroyEnvironment% = 1
RtlDestroyHandleTable% = 1
RtlDestroyHeap% = 1
RtlDestroyProcessParameters% = 1
RtlDestroyQueryDebugBuffer% = 1
RtlDetermineDosPathNameType_U% = 1
RtlDllShutdownInProgress% = 0
RtlDnsHostNameToComputerName% = 3
RtlDoesFileExists_U% = 1
RtlDosApplyFileIsolationRedirection_Ustr% = 9
RtlDosPathNameToNtPathName_U% = 4
RtlDosSearchPath_U% = 6
RtlDosSearchPath_Ustr% = 9
RtlDowncaseUnicodeChar% = 1
RtlDowncaseUnicodeString% = 3
RtlDumpResource% = 1
RtlDuplicateUnicodeString% = 3
RtlEmptyAtomTable% = 2
RtlEnableEarlyCriticalSectionEventCreation% = 0
RtlEncodePointer% = 1
RtlEncodeSystemPointer% = 1
RtlEnlargedIntegerMultiply% = 2
RtlEnlargedUnsignedDivide% = 4
RtlEnlargedUnsignedMultiply% = 2
RtlEnterCriticalSection% = 1
RtlEnumProcessHeaps% = 2
RtlEnumerateGenericTable% = 2
RtlEnumerateGenericTableAvl% = 2
RtlEnumerateGenericTableLikeADirectory% = 7
RtlEnumerateGenericTableWithoutSplaying% = 2
RtlEnumerateGenericTableWithoutSplayingAvl% = 2
RtlEqualComputerName% = 2
RtlEqualDomainName% = 2
RtlEqualLuid% = 2
RtlEqualPrefixSid% = 2
RtlEqualSid% = 2
RtlEqualString% = 3
RtlEqualUnicodeString% = 3
RtlEraseUnicodeString% = 1
RtlExitUserThread% = 1
RtlExpandEnvironmentStrings_U% = 4
RtlExtendHeap% = 4
RtlExtendedIntegerMultiply% = 3
RtlExtendedLargeIntegerDivide% = 4
RtlExtendedMagicDivide% = 5
RtlFillMemory% = 3
RtlFillMemoryUlong% = 3
RtlFinalReleaseOutOfProcessMemoryStream% = 1
RtlFindActivationContextSectionGuid% = 5
RtlFindActivationContextSectionString% = 5
RtlFindCharInUnicodeString% = 4
RtlFindClearBits% = 3
RtlFindClearBitsAndSet% = 3
RtlFindClearRuns% = 4
RtlFindLastBackwardRunClear% = 3
RtlFindLeastSignificantBit% = 2
RtlFindLongestRunClear% = 2
RtlFindMessage% = 5
RtlFindMostSignificantBit% = 2
RtlFindNextForwardRunClear% = 3
RtlFindRange% = 12
RtlFindSetBits% = 3
RtlFindSetBitsAndClear% = 3
RtlFirstEntrySList% = 1
RtlFirstFreeAce% = 2
RtlFlushSecureMemoryCache% = 2
RtlFormatCurrentUserKeyPath% = 1
RtlFormatMessage% = 9
RtlFreeAnsiString% = 1
RtlFreeHandle% = 2
RtlFreeHeap% = 3
RtlFreeOemString% = 1
RtlFreeRangeList% = 1
RtlFreeSid% = 1
RtlFreeThreadActivationContextStack% = 0
RtlFreeUnicodeString% = 1
RtlFreeUserThreadStack% = 2
RtlGUIDFromString% = 2
RtlGenerate8dot3Name% = 4
RtlGetAce% = 3
RtlGetActiveActivationContext% = 1
RtlGetCallersAddress% = 2
RtlGetCompressionWorkSpaceSize% = 3
RtlGetControlSecurityDescriptor% = 3
RtlGetCurrentDirectory_U% = 2
RtlGetCurrentPeb% = 0
RtlGetDaclSecurityDescriptor% = 4
RtlGetElementGenericTable% = 2
RtlGetElementGenericTableAvl% = 2
RtlGetFirstRange% = 3
RtlGetFrame% = 0
RtlGetFullPathName_U% = 4
RtlGetGroupSecurityDescriptor% = 3
RtlGetLastNtStatus% = 0
RtlGetLastWin32Error% = 0
RtlGetLengthWithoutLastFullDosOrNtPathElement% = 3
RtlGetLengthWithoutTrailingPathSeperators% = 3
RtlGetLongestNtPathLength% = 0
RtlGetNativeSystemInformation% = 4
RtlGetNextRange% = 3
RtlGetNtGlobalFlags% = 0
RtlGetNtProductType% = 1
RtlGetNtVersionNumbers% = 3
RtlGetOwnerSecurityDescriptor% = 3
RtlGetProcessHeaps% = 2
RtlGetSaclSecurityDescriptor% = 4
RtlGetSecurityDescriptorRMControl% = 2
RtlGetSetBootStatusData% = 6
RtlGetUnloadEventTrace% = 0
RtlGetUserInfoHeap% = 5
RtlGetVersion% = 1
RtlHashUnicodeString% = 4
RtlIdentifierAuthoritySid% = 1
RtlImageDirectoryEntryToData% = 4
RtlImageNtHeader% = 1
RtlImageRvaToSection% = 3
RtlImageRvaToVa% = 4
RtlImpersonateSelf% = 1
RtlInitAnsiString% = 2
RtlInitCodePageTable% = 2
RtlInitMemoryStream% = 1
RtlInitNlsTables% = 4
RtlInitOutOfProcessMemoryStream% = 1
RtlInitString% = 2
RtlInitUnicodeString% = 2
RtlInitUnicodeStringEx% = 2
RtlInitializeAtomPackage% = 1
RtlInitializeBitMap% = 3
RtlInitializeContext% = 5
RtlInitializeCriticalSection% = 1
RtlInitializeCriticalSectionAndSpinCount% = 2
RtlInitializeGenericTable% = 5
RtlInitializeGenericTableAvl% = 5
RtlInitializeHandleTable% = 3
RtlInitializeRXact% = 3
RtlInitializeRangeList% = 1
RtlInitializeResource% = 1
RtlInitializeSListHead% = 1
RtlInitializeSid% = 3
RtlInitializeStackTraceDataBase% = 3
RtlInsertElementGenericTable% = 4
RtlInsertElementGenericTableAvl% = 4
RtlInt64ToUnicodeString% = 4
RtlIntegerToChar% = 4
RtlIntegerToUnicodeString% = 3
RtlInterlockedFlushSList% = 1
RtlInterlockedPopEntrySList% = 1
RtlInterlockedPushEntrySList% = 2
RtlInvertRangeList% = 2
RtlIpv4AddressToString% = 2
RtlIpv4AddressToStringEx% = 4
RtlIpv4StringToAddress% = 4
RtlIpv4StringToAddressEx% = 4
RtlIpv6AddressToString% = 2
RtlIpv6AddressToStringEx% = 5
RtlIpv6StringToAddress% = 3
RtlIpv6StringToAddressEx% = 4
RtlIsActivationContextActive% = 1
RtlIsDosDeviceName_U% = 1
RtlIsGenericTableEmpty% = 1
RtlIsGenericTableEmptyAvl% = 1
RtlIsNameLegalDOS8Dot3% = 3
RtlIsRangeAvailable% = 10
RtlIsTextUnicode% = 3
RtlIsThreadWithinLoaderCallout% = 0
RtlIsValidHandle% = 2
RtlIsValidIndexHandle% = 3
RtlLargeIntegerAdd% = 4
RtlLargeIntegerArithmeticShift% = 3
RtlLargeIntegerDivide% = 5
RtlLargeIntegerNegate% = 2
RtlLargeIntegerShiftLeft% = 3
RtlLargeIntegerShiftRight% = 3
RtlLargeIntegerSubtract% = 4
RtlLargeIntegerToChar% = 4
RtlLeaveCriticalSection% = 1
RtlLengthRequiredSid% = 1
RtlLengthSecurityDescriptor% = 1
RtlLengthSid% = 1
RtlLocalTimeToSystemTime% = 2
RtlLockBootStatusData% = 1
RtlLockHeap% = 1
RtlLockMemoryStreamRegion% = 6
RtlLogStackBackTrace% = 0
RtlLookupAtomInAtomTable% = 3
RtlLookupElementGenericTable% = 2
RtlLookupElementGenericTableAvl% = 2
RtlMakeSelfRelativeSD% = 3
RtlMapGenericMask% = 2
RtlMapSecurityErrorToNtStatus% = 1
RtlMergeRangeLists% = 4
RtlMoveMemory% = 3
RtlMultiAppendUnicodeStringBuffer% = 3
RtlMultiByteToUnicodeN% = 5
RtlMultiByteToUnicodeSize% = 3
RtlNewInstanceSecurityObject% = 10
RtlNewSecurityGrantedAccess% = 6
RtlNewSecurityObject% = 6
RtlNewSecurityObjectEx% = 8
RtlNewSecurityObjectWithMultipleInheritance% = 9
RtlNormalizeProcessParams% = 1
RtlNtPathNameToDosPathName% = 4
RtlNtStatusToDosError% = 1
RtlNtStatusToDosErrorNoTeb% = 1
RtlNumberGenericTableElements% = 1
RtlNumberGenericTableElementsAvl% = 1
RtlNumberOfClearBits% = 1
RtlNumberOfSetBits% = 1
RtlOemStringToUnicodeSize% = 1
RtlOemStringToUnicodeString% = 3
RtlOemToUnicodeN% = 5
RtlOpenCurrentUser% = 2
RtlPcToFileHeader% = 2
RtlPinAtomInAtomTable% = 2
RtlPopFrame% = 1
RtlPrefixString% = 3
RtlPrefixUnicodeString% = 3
RtlProtectHeap% = 2
RtlPushFrame% = 1
RtlQueryAtomInAtomTable% = 6
RtlQueryDepthSList% = 1
RtlQueryEnvironmentVariable_U% = 3
RtlQueryHeapInformation% = 5
RtlQueryInformationAcl% = 4
RtlQueryInformationActivationContext% = 7
RtlQueryInformationActiveActivationContext% = 4
RtlQueryInterfaceMemoryStream% = 3
RtlQueryProcessBackTraceInformation% = 1
RtlQueryProcessDebugInformation% = 3
RtlQueryProcessHeapInformation% = 1
RtlQueryProcessLockInformation% = 1
RtlQueryRegistryValues% = 5
RtlQuerySecurityObject% = 5
RtlQueryTagHeap% = 5
RtlQueryTimeZoneInformation% = 1
RtlQueueApcWow64Thread% = 5
RtlQueueWorkItem% = 3
RtlRaiseException% = 1
RtlRaiseStatus% = 1
RtlRandom% = 1
RtlRandomEx% = 1
RtlReAllocateHeap% = 4
RtlReadMemoryStream% = 4
RtlReadOutOfProcessMemoryStream% = 4
RtlRealPredecessor% = 1
RtlRealSuccessor% = 1
RtlRegisterSecureMemoryCacheCallback% = 1
RtlRegisterWait% = 6
RtlReleaseActivationContext% = 1
RtlReleaseMemoryStream% = 1
RtlReleasePebLock% = 0
RtlReleaseResource% = 1
RtlRemoteCall% = 7
RtlRemoveVectoredExceptionHandler% = 1
RtlResetRtlTranslations% = 1
RtlRestoreLastWin32Error% = 1
RtlRevertMemoryStream% = 1
RtlRunDecodeUnicodeString% = 2
RtlRunEncodeUnicodeString% = 2
RtlSecondsSince1970ToTime% = 2
RtlSecondsSince1980ToTime% = 2
RtlSeekMemoryStream% = 5
RtlSelfRelativeToAbsoluteSD2% = 2
RtlSelfRelativeToAbsoluteSD% = 11
RtlSetAllBits% = 1
RtlSetAttributesSecurityDescriptor% = 3
RtlSetBits% = 3
RtlSetControlSecurityDescriptor% = 3
RtlSetCriticalSectionSpinCount% = 2
RtlSetCurrentDirectory_U% = 1
RtlSetCurrentEnvironment% = 2
RtlSetDaclSecurityDescriptor% = 4
RtlSetEnvironmentVariable% = 3
RtlSetGroupSecurityDescriptor% = 3
RtlSetHeapInformation% = 4
RtlSetInformationAcl% = 4
RtlSetIoCompletionCallback% = 3
RtlSetLastWin32Error% = 1
RtlSetLastWin32ErrorAndNtStatusFromNtStatus% = 1
RtlSetMemoryStreamSize% = 3
RtlSetOwnerSecurityDescriptor% = 3
RtlSetSaclSecurityDescriptor% = 4
RtlSetSecurityDescriptorRMControl% = 2
RtlSetSecurityObject% = 5
RtlSetSecurityObjectEx% = 6
RtlSetThreadPoolStartFunc% = 2
RtlSetTimeZoneInformation% = 1
RtlSetTimer% = 7
RtlSetUnicodeCallouts% = 1
RtlSetUserFlagsHeap% = 5
RtlSetUserValueHeap% = 4
RtlSizeHeap% = 3
RtlSplay% = 1
RtlStartRXact% = 1
RtlStatMemoryStream% = 3
RtlStringFromGUID% = 2
RtlSubAuthorityCountSid% = 1
RtlSubAuthoritySid% = 2
RtlSubtreePredecessor% = 1
RtlSubtreeSuccessor% = 1
RtlSystemTimeToLocalTime% = 2
RtlTimeFieldsToTime% = 2
RtlTimeToElapsedTimeFields% = 2
RtlTimeToSecondsSince1970% = 2
RtlTimeToSecondsSince1980% = 2
RtlTimeToTimeFields% = 2
RtlTraceDatabaseAdd% = 4
RtlTraceDatabaseCreate% = 5
RtlTraceDatabaseDestroy% = 1
RtlTraceDatabaseEnumerate% = 3
RtlTraceDatabaseFind% = 4
RtlTraceDatabaseLock% = 1
RtlTraceDatabaseUnlock% = 1
RtlTraceDatabaseValidate% = 1
RtlTryEnterCriticalSection% = 1
RtlUnhandledExceptionFilter2% = 2
RtlUnhandledExceptionFilter% = 1
RtlUnicodeStringToAnsiSize% = 1
RtlUnicodeStringToAnsiString% = 3
RtlUnicodeStringToCountedOemString% = 3
RtlUnicodeStringToInteger% = 3
RtlUnicodeStringToOemSize% = 1
RtlUnicodeStringToOemString% = 3
RtlUnicodeToCustomCPN% = 6
RtlUnicodeToMultiByteN% = 5
RtlUnicodeToMultiByteSize% = 3
RtlUnicodeToOemN% = 5
RtlUniform% = 1
RtlUnlockBootStatusData% = 1
RtlUnlockHeap% = 1
RtlUnlockMemoryStreamRegion% = 6
RtlUnwind% = 4
RtlUpcaseUnicodeChar% = 1
RtlUpcaseUnicodeString% = 3
RtlUpcaseUnicodeStringToAnsiString% = 3
RtlUpcaseUnicodeStringToCountedOemString% = 3
RtlUpcaseUnicodeStringToOemString% = 3
RtlUpcaseUnicodeToCustomCPN% = 6
RtlUpcaseUnicodeToMultiByteN% = 5
RtlUpcaseUnicodeToOemN% = 5
RtlUpdateTimer% = 4
RtlUpperChar% = 1
RtlUpperString% = 2
RtlUsageHeap% = 3
RtlValidAcl% = 1
RtlValidRelativeSecurityDescriptor% = 3
RtlValidSecurityDescriptor% = 1
RtlValidSid% = 1
RtlValidateHeap% = 3
RtlValidateProcessHeaps% = 0
RtlValidateUnicodeString% = 2
RtlVerifyVersionInfo% = 4
RtlWalkFrameChain% = 3
RtlWalkHeap% = 2
RtlWriteMemoryStream% = 4
RtlWriteRegistryValue% = 6
RtlZeroHeap% = 2
RtlZeroMemory% = 2
RtlZombifyActivationContext% = 1
RtlpApplyLengthFunction% = 4
RtlpEnsureBufferSize% = 3
RtlpNotOwnerCriticalSection% = 1
RtlpNtCreateKey% = 6
RtlpNtEnumerateSubKey% = 4
RtlpNtMakeTemporaryKey% = 1
RtlpNtOpenKey% = 4
RtlpNtQueryValueKey% = 5
RtlpNtSetValueKey% = 4
RtlpUnWaitCriticalSection% = 1
RtlpWaitForCriticalSection% = 1
RtlxAnsiStringToUnicodeSize% = 1
RtlxOemStringToUnicodeSize% = 1
RtlxUnicodeStringToAnsiSize% = 1
RtlxUnicodeStringToOemSize% = 1
VerSetConditionMask% = 4
ZwAcceptConnectPort% = 6
ZwAccessCheck% = 8
ZwAccessCheckAndAuditAlarm% = 11
ZwAccessCheckByType% = 11
ZwAccessCheckByTypeAndAuditAlarm% = 16
ZwAccessCheckByTypeResultList% = 11
ZwAccessCheckByTypeResultListAndAuditAlarm% = 16
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle% = 17
ZwAddAtom% = 3
ZwAddBootEntry% = 2
ZwAdjustGroupsToken% = 6
ZwAdjustPrivilegesToken% = 6
ZwAlertResumeThread% = 2
ZwAlertThread% = 1
ZwAllocateLocallyUniqueId% = 1
ZwAllocateUserPhysicalPages% = 3
ZwAllocateUuids% = 4
ZwAllocateVirtualMemory% = 6
ZwAreMappedFilesTheSame% = 2
ZwAssignProcessToJobObject% = 2
ZwCallbackReturn% = 3
ZwCancelDeviceWakeupRequest% = 1
ZwCancelIoFile% = 2
ZwCancelTimer% = 2
ZwClearEvent% = 1
ZwClose% = 1
ZwCloseObjectAuditAlarm% = 3
ZwCompactKeys% = 2
ZwCompareTokens% = 3
ZwCompleteConnectPort% = 1
ZwCompressKey% = 1
ZwConnectPort% = 8
ZwContinue% = 2
ZwCreateDebugObject% = 4
ZwCreateDirectoryObject% = 3
ZwCreateEvent% = 5
ZwCreateEventPair% = 3
ZwCreateFile% = 11
ZwCreateIoCompletion% = 4
ZwCreateJobObject% = 3
ZwCreateJobSet% = 3
ZwCreateKey% = 7
ZwCreateKeyedEvent% = 4
ZwCreateMailslotFile% = 8
ZwCreateMutant% = 4
ZwCreateNamedPipeFile% = 14
ZwCreatePagingFile% = 4
ZwCreatePort% = 5
ZwCreateProcess% = 8
ZwCreateProcessEx% = 9
ZwCreateProfile% = 9
ZwCreateSection% = 7
ZwCreateSemaphore% = 5
ZwCreateSymbolicLinkObject% = 4
ZwCreateThread% = 8
ZwCreateTimer% = 4
ZwCreateToken% = 13
ZwCreateWaitablePort% = 5
ZwDebugActiveProcess% = 2
ZwDebugContinue% = 3
ZwDelayExecution% = 2
ZwDeleteAtom% = 1
ZwDeleteBootEntry% = 1
ZwDeleteFile% = 1
ZwDeleteKey% = 1
ZwDeleteObjectAuditAlarm% = 3
ZwDeleteValueKey% = 2
ZwDeviceIoControlFile% = 10
ZwDisplayString% = 1
ZwDuplicateObject% = 7
ZwDuplicateToken% = 6
ZwEnumerateBootEntries% = 2
ZwEnumerateKey% = 6
ZwEnumerateSystemEnvironmentValuesEx% = 3
ZwEnumerateValueKey% = 6
ZwExtendSection% = 2
ZwFilterToken% = 6
ZwFindAtom% = 3
ZwFlushBuffersFile% = 2
ZwFlushInstructionCache% = 3
ZwFlushKey% = 1
ZwFlushVirtualMemory% = 4
ZwFlushWriteBuffer% = 0
ZwFreeUserPhysicalPages% = 3
ZwFreeVirtualMemory% = 4
ZwFsControlFile% = 10
ZwGetContextThread% = 2
ZwGetDevicePowerState% = 2
ZwGetPlugPlayEvent% = 4
ZwGetWriteWatch% = 7
ZwImpersonateAnonymousToken% = 1
ZwImpersonateClientOfPort% = 2
ZwImpersonateThread% = 3
ZwInitializeRegistry% = 1
ZwInitiatePowerAction% = 4
ZwIsProcessInJob% = 2
ZwIsSystemResumeAutomatic% = 0
ZwListenPort% = 2
ZwLoadDriver% = 1
ZwLoadKey2% = 3
ZwLoadKey% = 2
ZwLockFile% = 10
ZwLockProductActivationKeys% = 2
ZwLockRegistryKey% = 1
ZwLockVirtualMemory% = 4
ZwMakePermanentObject% = 1
ZwMakeTemporaryObject% = 1
ZwMapUserPhysicalPages% = 3
ZwMapUserPhysicalPagesScatter% = 3
ZwMapViewOfSection% = 10
ZwModifyBootEntry% = 1
ZwNotifyChangeDirectoryFile% = 9
ZwNotifyChangeKey% = 10
ZwNotifyChangeMultipleKeys% = 12
ZwOpenDirectoryObject% = 3
ZwOpenEvent% = 3
ZwOpenEventPair% = 3
ZwOpenFile% = 6
ZwOpenIoCompletion% = 3
ZwOpenJobObject% = 3
ZwOpenKey% = 3
ZwOpenKeyedEvent% = 3
ZwOpenMutant% = 3
ZwOpenObjectAuditAlarm% = 12
ZwOpenProcess% = 4
ZwOpenProcessToken% = 3
ZwOpenProcessTokenEx% = 4
ZwOpenSection% = 3
ZwOpenSemaphore% = 3
ZwOpenSymbolicLinkObject% = 3
ZwOpenThread% = 4
ZwOpenThreadToken% = 4
ZwOpenThreadTokenEx% = 5
ZwOpenTimer% = 3
ZwPlugPlayControl% = 3
ZwPowerInformation% = 5
ZwPrivilegeCheck% = 3
ZwPrivilegeObjectAuditAlarm% = 6
ZwPrivilegedServiceAuditAlarm% = 5
ZwProtectVirtualMemory% = 5
ZwPulseEvent% = 2
ZwQueryAttributesFile% = 2
ZwQueryBootEntryOrder% = 2
ZwQueryBootOptions% = 2
ZwQueryDebugFilterState% = 2
ZwQueryDefaultLocale% = 2
ZwQueryDefaultUILanguage% = 1
ZwQueryDirectoryFile% = 11
ZwQueryDirectoryObject% = 7
ZwQueryEaFile% = 9
ZwQueryEvent% = 5
ZwQueryFullAttributesFile% = 2
ZwQueryInformationAtom% = 5
ZwQueryInformationFile% = 5
ZwQueryInformationJobObject% = 5
ZwQueryInformationPort% = 5
ZwQueryInformationProcess% = 5
ZwQueryInformationThread% = 5
ZwQueryInformationToken% = 5
ZwQueryInstallUILanguage% = 1
ZwQueryIntervalProfile% = 2
ZwQueryIoCompletion% = 5
ZwQueryKey% = 5
ZwQueryMultipleValueKey% = 6
ZwQueryMutant% = 5
ZwQueryObject% = 5
ZwQueryOpenSubKeys% = 2
ZwQueryPerformanceCounter% = 2
ZwQueryPortInformationProcess% = 0
ZwQueryQuotaInformationFile% = 9
ZwQuerySection% = 5
ZwQuerySecurityObject% = 5
ZwQuerySemaphore% = 5
ZwQuerySymbolicLinkObject% = 3
ZwQuerySystemEnvironmentValue% = 4
ZwQuerySystemEnvironmentValueEx% = 5
ZwQuerySystemInformation% = 4
ZwQuerySystemTime% = 1
ZwQueryTimer% = 5
ZwQueryTimerResolution% = 3
ZwQueryValueKey% = 6
ZwQueryVirtualMemory% = 6
ZwQueryVolumeInformationFile% = 5
ZwQueueApcThread% = 5
ZwRaiseException% = 3
ZwRaiseHardError% = 6
ZwReadFile% = 9
ZwReadFileScatter% = 9
ZwReadRequestData% = 6
ZwReadVirtualMemory% = 5
ZwRegisterThreadTerminatePort% = 1
ZwReleaseKeyedEvent% = 4
ZwReleaseMutant% = 2
ZwReleaseSemaphore% = 3
ZwRemoveIoCompletion% = 5
ZwRemoveProcessDebug% = 2
ZwRenameKey% = 2
ZwReplaceKey% = 3
ZwReplyPort% = 2
ZwReplyWaitReceivePort% = 4
ZwReplyWaitReceivePortEx% = 5
ZwReplyWaitReplyPort% = 2
ZwRequestDeviceWakeup% = 1
ZwRequestPort% = 2
ZwRequestWaitReplyPort% = 3
ZwRequestWakeupLatency% = 1
ZwResetEvent% = 2
ZwResetWriteWatch% = 3
ZwRestoreKey% = 3
ZwResumeProcess% = 1
ZwResumeThread% = 2
ZwSaveKey% = 2
ZwSaveKeyEx% = 3
ZwSaveMergedKeys% = 3
ZwSecureConnectPort% = 9
ZwSetBootEntryOrder% = 2
ZwSetBootOptions% = 2
ZwSetContextThread% = 2
ZwSetDebugFilterState% = 3
ZwSetDefaultHardErrorPort% = 1
ZwSetDefaultLocale% = 2
ZwSetDefaultUILanguage% = 1
ZwSetEaFile% = 4
ZwSetEvent% = 2
ZwSetEventBoostPriority% = 1
ZwSetHighEventPair% = 1
ZwSetHighWaitLowEventPair% = 1
ZwSetInformationDebugObject% = 5
ZwSetInformationFile% = 5
ZwSetInformationJobObject% = 4
ZwSetInformationKey% = 4
ZwSetInformationObject% = 4
ZwSetInformationProcess% = 4
ZwSetInformationThread% = 4
ZwSetInformationToken% = 4
ZwSetIntervalProfile% = 2
ZwSetIoCompletion% = 5
ZwSetLdtEntries% = 6
ZwSetLowEventPair% = 1
ZwSetLowWaitHighEventPair% = 1
ZwSetQuotaInformationFile% = 4
ZwSetSecurityObject% = 3
ZwSetSystemEnvironmentValue% = 2
ZwSetSystemEnvironmentValueEx% = 5
ZwSetSystemInformation% = 3
ZwSetSystemPowerState% = 3
ZwSetSystemTime% = 2
ZwSetThreadExecutionState% = 2
ZwSetTimer% = 7
ZwSetTimerResolution% = 3
ZwSetUuidSeed% = 1
ZwSetValueKey% = 6
ZwSetVolumeInformationFile% = 5
ZwShutdownSystem% = 1
ZwSignalAndWaitForSingleObject% = 4
ZwStartProfile% = 1
ZwStopProfile% = 1
ZwSuspendProcess% = 1
ZwSuspendThread% = 2
ZwSystemDebugControl% = 6
ZwTerminateJobObject% = 2
ZwTerminateProcess% = 2
ZwTerminateThread% = 2
ZwTestAlert% = 0
ZwTraceEvent% = 4
ZwTranslateFilePath% = 4
ZwUnloadDriver% = 1
ZwUnloadKey% = 1
ZwUnloadKeyEx% = 2
ZwUnlockFile% = 5
ZwUnlockVirtualMemory% = 4
ZwUnmapViewOfSection% = 2
ZwVdmControl% = 2
ZwWaitForDebugEvent% = 4
ZwWaitForKeyedEvent% = 4
ZwWaitForMultipleObjects% = 5
ZwWaitForSingleObject% = 3
ZwWaitHighEventPair% = 1
ZwWaitLowEventPair% = 1
ZwWriteFile% = 9
ZwWriteFileGather% = 9
ZwWriteRequestData% = 6
ZwWriteVirtualMemory% = 5
ZwYieldExecution% = 0
_rt_probe_read4% = 1
_seh_longjmp_unwind% = 1
vDbgPrintEx% = 4
vDbgPrintExWithPrefix% = 5
